IEC 61850 GOOSE: A Systematic Literature Review on the State of the Art and Current Applications

Abstract

To develop secure, fast, and interoperable smart substations, it is vital to understand the current situation and potential future directions of the technologies involved. This study presents the evolution and state of the art of the Generic Object Oriented Substation Event (GOOSE) communication protocol, defined by the International Electrotechnical Commission (IEC) 61850 standard. A Systematic Literature Review (SLR) was conducted following the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) protocol. This included journal articles published from 2004 to 2025 and conference papers from 2020 to 2025, written in English within Engineering. Only studies primarily focusing on GOOSE, citing it at least ten times, and indexed in the Scopus, IEEE Xplore, and Web of Science databases were included. The quantitative analysis used SciMAT software, complemented by a qualitative analysis. Due to the bibliometric and thematic nature of this review, potential biases were considered at the review level rather than by applying a formal study-level risk-of-bias tool. The final analysis comprised 82 journal articles and 84 conference papers. The results offer a comprehensive mapping of GOOSE research evolution, identify nine main challenges and limitations from the last 22 years, and highlight current research directions. The literature reveals methodological heterogeneity, a predominance of simulation-based approaches, and limited large-scale empirical validation.

1. Introduction

The modernization of electrical power systems in generation, transmission, and distribution has led to an increasing reliance on digital communication for monitoring, control, and protection, while electrical substations have been significantly enhanced through the adoption of automation technologies [1]. One of the most impactful innovations at the core of this transformation is the Generic Object Oriented Substation Event (GOOSE) messaging service, introduced by the International Electrotechnical Commission (IEC) 61850 standard.

GOOSE is a multicast-based, Publisher–Subscriber (PubSub) interaction communication protocol for event-based messaging in substations [2,3,4]. Used for peer-to-peer transmission in protection and control applications, this protocol ensures performance with minimal latency, in contrast to traditional point-to-point and serial communication methods [3,5]. Its characteristics have transformed how substations operate, improving interoperability, allowing faster response times, and enhancing overall system reliability [6]. In this way, GOOSE enables the quick and reliable exchange of real-time (RT) data between Intelligent Electronic Devices (IEDs) in local protection schemes and also in wide areas, supporting critical functions such as protection trip commands, status monitoring, and interlocking [6].

Beyond basic protection schemes, GOOSE’s flexibility and speed make it suitable for more advanced substation automation implementations, including load shedding, islanding detection, and distributed protection coordination [3,6,7]. Despite its advantages, the growing connectivity and reliance on networked communication due to the technology’s evolution have introduced new challenges in the last 22 years, particularly in the domain of cybersecurity [2,4,5]. Consequently, as substations become increasingly integrated into smart grid infrastructures, enhancing the security of their communication protocols has evolved into a critical concern for the engineering, academic, and industrial fields [4,5].

In this way, considering the 22 years that have passed since the introduction of the GOOSE protocol by IEC 61850-8-1 in 2004 [8], this paper aims to provide a comprehensive view of the evolution of the IEC 61850 GOOSE protocol and to explore the current research in this field. These aims will be achieved through a complete Systematic Literature Review (SLR) [9], guided by the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) protocol [10,11] in order to assist the data extraction from the articles, and by the software tool SciMAT v1.1.06 for the quantitative analysis via bibliometric mapping. This study will help other researchers in the area to enhance their understanding of the IEC 61850 GOOSE messaging service, via the compilation of the most recent scientific knowledge and technological developments on this protocol, as well as its evolution during its existence.

The remainder of this paper is structured as follows: Section 2 provides a comprehensive background on GOOSE and its technical specifications; Section 3 discusses related reviews on GOOSE; the methodology of the SLR is presented in Section 4; Section 5 reports the results and discussion; and finally, Section 6 presents the conclusion.

2. Background

2.1. Electrical Substations and IEC 61850

Electrical substations are vital elements in the power grid, acting as central hubs for the regulation and distribution of electrical power. These facilities, which can be either indoors or outdoors, provide key nodes where operators can monitor and control the flow of electricity, ensuring stability and safety on the power grid [2]. A substation typically consists of two main components: power and communication systems, as shown in Figure 1. The power system has three main units: the generation component, the Energy Storage System (ESS), and the load [12]. On the other hand, the communication system is divided into Process, Bay, and Station levels, according to IEC 61850 [2,12].

Figure 1. Main components of a substation system based on [2,12].

In traditional substations, each electrical signal is transmitted from Process Level devices to the control room on the Station Level using individual copper wiring [2,13]. This approach often leads to failures, high maintenance needs, and increased operational costs [2]. Digital substations, in turn, convert signals at the Process level, transmitting data over reliable network connections to the control station, thereby improving efficiency and reducing costs [2]. Digital substations implement a Substation Automation System (SAS), characterized by digital communication networks (typically Ethernet/IEC 61850) and IEDs that enable protection, control, monitoring, and automation. The main challenge that SAS aims to solve is the communication between IEDs from different vendors, each using its own exclusive technologies and proprietary protocols that are not compatible with the others [2].

Hence, as energy demands increase globally [14] and the evolution of the technology raises new interoperability issues in power systems, adopting an open architecture with a simplified communication system can offer several advantages. These design principles are central to IEC 61850, known as “the international standard for Ethernet-based communication in substations” [2]. Created with the aim of solving interoperability problems and establishing system requirements that affect IEDs and legacy systems in substations [5,15], the IEC 61850 standard introduces core features such as RT control and a distributed, object-oriented model [13].

IEC 61850 structures information by hierarchically layering it in an object-oriented model, with a uniform self-description language and abstract service interfaces, such as the Abstract Communication Service Interface (ACSI) and the Special Communication Service Mapping (SCSM) [3,16]. The data model organizes IEDs into standardized, function-specific components with both syntactic and semantic consistency [16,17]. These components are configured using a dedicated Extensible Markup Language (XML)-based programming language known as Substation Configuration Language (SCL) [2,18].

Based on configuration files written in SCL, IEDs are represented as Logical Devices (LDs), which serve as virtual abstractions of physical IEDs [3,19]. Each LD encompasses a set of Logical Nodes (LNs), which encapsulate specific functions that correspond to real-world system operations such as protection, control, and monitoring [3,13]. The functions represented by LNs are further subdivided into Data Objects (DOs), which are the functional properties of each LN [3]. These DOs are associated with Functional Constraints (FCs), which define their accessibility within the system [2]: for example, whether a particular data point can be read, written, or reported by an operator. The measurable properties of each DO are referred to as Data Attributes (DAs). DAs form the core of this hierarchical model, each carrying a value, timestamp, quality indicator, and description [2]. This approach distinguishes IEC 61850 from other standards, such as Transmission Control Protocol/Internet Protocol (TCP/IP), Distributed Network Protocol (DNP3), and IEC 60870-5-104, which focus solely on defining message formats and contents [6].

IEC 61850 introduces four protocols according to the Open Systems Interconnection Reference Model (OSI/RM): Manufacturing Message Specification (MMS), Sampled Values (SV), GOOSE, and Simple Network Time Protocol (SNTP). Each protocol in the standard has specific functions depending on the substation level in which they are applied. The MMS protocol is used for communication between the IEDs at the Bay level and the supervisory equipment at the Station level via the Process Bus, as well as for communication with the Remote Terminal Units (RTUs) [2]. This protocol is based on TCP/IP and operates in a Client/Server model, transmitting data via polling or reporting, as well as commands and write-data within 100 ms intervals, having no RT requirements [5,20]. The SV protocol is used between the Process and Bay levels for transmission of analog data, such as current and voltage measurements, from the Merging Units (MUs) to the IEDs, with RT requirements to ensure that these messages are received by the recipient within 3 ms [20]. SV works via multicast PubSub communication, allowing multiple devices to receive data at a specified frequency as soon as they are connected in the network and subscribed to a topic [21]. The SNTP protocol, in turn, is used by the standard for time-synchronization of these protocols within the IEDs in the SAS [17].

2.2. The GOOSE Protocol

IEC 61850-7-2, published for the first time in 2003, defines the Generic Substation Event (GSE) service in order to enable RT and safe transmission of input and output and analog or digital data [22,23]. One of the key messages within GSE services is supported by the GOOSE protocol, introduced by IEC 61850-8-1 Ed. 1.0 in 2004, which operates directly on the data-link layer of the OSI/RM and is highly suitable for substation environments using Local Area Networks (LANs) [24]. Similarly to SV, this protocol communicates via multicast PubSub and has strict RT requirements. According to IEC 61850, GOOSE messages must meet an end-to-end latency requirement of less than 3 milliseconds for trip commands [20]. Fault tolerance is typically achieved through network redundancy mechanisms such as spatial replication in the Substation Communication Network (SCN) [7].

GOOSE is essential for executing protection and control (P&C) functions. Its messages are structured to satisfy the system’s RT demands by dynamically adapting their transmission pattern as required. When no events occur, messages are sent periodically as low-frequency heartbeat signals, with an initial retransmission interval (“T0”) that is configurable, up to a maximum of one minute. This periodic pattern is interrupted once an IED detects an event within the substation, prompting a P&C action in the SAS. Upon detection, GOOSE begins rapid message retransmission, starting with a short interval (“T1”), which can be as brief as 1 ms and no longer than 3 ms, to guarantee the fast and reliable delivery of critical updates. The retransmission intervals then gradually increase (“T2”, “T3”, etc.) until the system returns to a steady state. These timing parameters help receiving devices differentiate between new events and repeated transmissions of existing ones, supporting message integrity and overall system reliability [7,25]. Figure 2 illustrates this mechanism.

Figure 2. GOOSE transmission pattern; adapted from [8].

The GOOSE frame structure includes the following components [18,22]:

• Preamble and start fields: the same as in the Ethernet frame; used for synchronization and indication of the beginning of the frame, respectively.
• Media Access Control (MAC) Header: uses a unicast destination MAC address (built as “01-0C-CD-xx-xx-xx”) and the multicast source MAC address of the sender.
• Priority Tagging: supports Virtual Local Area Network (VLAN) priority tagging via the IEEE 802.1Q standard in the Tag Protocol Identifier (TPID) field, with user-defined priority levels to manage network traffic and prioritize critical messages in the Tag Control Information (TCI) field.
• EtherType: “0x88B8” indicating a GOOSE message.
• Application Identifier (APPID): For application identification, generally “00”.
• Length: Total number of bytes of the message, including from APPID to Application Protocol Data Unit (APDU).
• Reserved bytes: Reserved for future versions of the standard.
• GOOSE APDU: Holds essential control and status data.
• The GOOSE APDU consists of 12 items:
• gocbRef: GOOSE control block reference, carries the name of the GOOSE control block.
• timeAllowedtoLive: refers to the maximum time a packet stays valid after its transmission.
• datSet: carries the name and description of the GOOSE dataset in the IED.
• goID: unique identifier assigned by the IED for the GOOSE message.
• t: timestamp of the GOOSE message; exact moment when stNum has changed.
• stNum: refers to the “State Number”, assigned when a new GOOSE message is generated and transmitted for a given dataset in the case of an event.
• sqNum: refers to the “Sequence Number”, incremented whenever a GOOSE message is sent.
• test: indicates that the messages sent are being used for test purposes.
• confRev: stands for “Configuration Revision”, indicating the IED version and counting configuration changes in the dataset.
• ndsCom: indicates that the data in the GOOSE message requires commissioning; subscribers should not use the data for control or protection until commissioning is complete.
• numDatSetEntries: indicates the number of dataset entries in a GOOSE message.
• allData: contains all the DOs and DAs of the dataset; payload of the GOOSE frame.

These fields contribute to reliability and synchronization. For example, confRev ensures configuration consistency between publisher and subscriber, while stNum and sqNum help to track state changes and message retransmissions, ensuring reliable communication [18,22]. Figure 3 presents the GOOSE frame.

Figure 3. GOOSE datagram based on [8].

In order to extend GOOSE functionalities to broader distances, IEC 61850-90-5 defined routable GOOSE (R-GOOSE), with the aim to allow GOOSE messages to be routed over Wide Area Networks (WANs), enabling communication between substations and even across entire power grids [26]. Different than standard GOOSE, R-GOOSE communicates via multicast User Datagram Protocol/Internet Protocol (UDP/IP) and uses the complete stack of the OSI/RM, potentially decreasing infrastructure investments for communication among distant RTUs while at the same time increasing cybersecurity risks [24,26]. Because of this, IEC 61850-90-5 includes cybersecurity considerations for R-GOOSE according to IEC 62351 [24].

In addition to R-GOOSE, the GOOSE protocol can be characterized in other types, depending on the application. The next chapter explains GOOSE behavior when implemented over Time-Sensitive Networking (TSN).

2.2.1. GOOSE over TSN

The integration of GOOSE messaging with TSN represents a major advancement in substation communication systems. While the IEC 61850 standard originally relied on Ethernet to support both time-triggered and event-triggered communications, traditional Ethernet lacks the deterministic capabilities required for critical messages like GOOSE [27,28]. These messages, used to implement P&C functions in substation automation systems, have strict latency and reliability requirements, especially in high-priority applications such as trip and blocking signals, which demand end-to-end latencies below 3 ms [7]. Under standard Ethernet, maintaining such guarantees often requires overprovisioning and still results in issues like jitter and bandwidth contention [27].

TSN addresses these limitations by enhancing Layer 2 Ethernet with mechanisms for deterministic delivery, traffic shaping, and precise time synchronization [7,27]. Key TSN features such as the Time-Aware Shaper (TAS—IEEE 802.1Qbv) and Generalized Precision Time Protocol (gPTP) synchronization (IEEE 802.1AS) enable accurate scheduling of message transmission and alignment of network nodes to a common time reference [7,28]. However, the integration of GOOSE traffic into TSN frameworks presents unique challenges due to its hybrid transmission behavior, making it less predictable than other time-critical streams [7].

To address these challenges, practical implementations typically classify GOOSE traffic into categories such as GOOSE 1A, GOOSE 1B, and GOOSE-LP (heartbeat), which are then mapped to different TSN priority levels. For instance, GOOSE 1A messages, which are highly critical and latency-sensitive, are assigned to high-priority queues (e.g., priority 6 in unprotected windows), while GOOSE 1B and GOOSE-LP, which are less time-sensitive, are given progressively lower priorities (e.g., priorities 5 and below) [27]. This classification enables efficient use of TSN resources by preventing the allocation of protected bandwidth to infrequent or low-urgency traffic [7]. Advanced TSN mechanisms like Frame Replication and Elimination for Reliability (FRER—IEEE 802.1CB) are selectively applied to high-priority GOOSE streams to enhance fault tolerance, while lower-priority traffic remains unreplicated to avoid unnecessary redundancy [7]. Additionally, features such as frame preemption (IEEE 802.1Qbu & 802.3br) and offset scheduling help minimize latency and jitter by allowing high-priority GOOSE messages to interrupt or bypass lower-priority transmissions [28]. Performance evaluations, including real substation proof-of-concept deployments and lab simulations, demonstrate that GOOSE over TSN achieves deterministic latencies as low as 30 µs, outperforming legacy analog systems [28]. Simulations also confirm that with proper scheduling, TSN can deliver critical GOOSE traffic at rates up to 670 Hz without loss [28], while keeping jitter under 10 µs [29]. Moreover, a deterministic global scheduling algorithm has been shown to reduce transmission delay by over 34% compared to TAS with First-In, First-Out (FIFO) queuing, ensuring minimal latency variation even under heavy network loads [29].

By enabling a unified and reliable communication backbone, TSN not only simplifies substation architectures but also enhances scalability, availability, and cyber-physical integration for future Smart Grids [28,29]. Its compatibility with IEC 61850 traffic models, combined with granular traffic classification and deterministic control, positions TSN as a foundational technology for next-generation digital substations [28].

2.2.2. Applications of GOOSE in Real-Life Substations

GOOSE is actively used in real-world substation environments. At the field level in substations, it supports critical applications such as interlocking schemes [30], load shedding [17], islanding detection [31], and circuit breaker failure protection control [4]. In the event of a circuit breaker malfunction, for instance, an IED can issue a GOOSE message to prompt surrounding IEDs to trip adjacent breakers, thereby ensuring fault isolation and minimizing system disruption [19].

A representative example of such functionality involves the use of protection relays that continuously monitor current and voltage measurements by subscribing to SV. Upon detecting a fault, the relay immediately transmits a trip command using a GOOSE message, which is delivered over the substation network with minimal latency, ensuring rapid isolation of the fault [5]. Circuit breakers configured as GOOSE subscribers detect the command and initiate the tripping mechanism accordingly [6]. Following the operation, circuit breakers may also publish their health and operational status via GOOSE, allowing supervisory systems and peer IEDs to assess their readiness and detect potential failures [5]. In scenarios requiring broader fault clearance, GOOSE facilitates the dissemination of critical control commands across the substation, enabling coordinated protection actions [19]. This architecture, featuring clearly defined communication roles and reliable message pathways, demonstrates the importance of robust communication protocols and resilient hardware in ensuring effective system protection and stability.

Beyond this scenario, GOOSE is deployed in a broad range of protection, control, and automation schemes [3]. For protection applications, it is commonly used in Breaker Failure Protection [19], busbar protection [3], differential protection in power transformers [16], and overcurrent blocking [32]. It also supports islanding detection in microgrids [31] and sympathetic tripping logic [3], particularly in industrial contexts. In the domain of control and automation, GOOSE supports Fault Location, Isolation, and Service Restoration (FLISR) [33], enables fast-acting load shedding [17], Load Tap Changer (LTC) control [3], and RT circuit breaker control and status indication [34]. Automatic Transfer Schemes (ATS), such as Main-Tie-Main configurations, benefit from GOOSE’s low-latency signaling to restore affected busbars by transferring loads to secondary sources [34]. Cross-bay interlocking is also achieved via GOOSE, replacing hardwired signals and enabling centralized logic coordination across substations [30]. Additional applications include harmonic blocking in transformers [16] and remote monitoring through Supervisory Control and Data Acquisition (SCADA) and video surveillance systems [35].

With the extension to R-GOOSE, the protocol’s functionality scales to wide-area applications [26]. It facilitates Distributed Protection and Control Schemes (DPACS) [26], enables synchrophasor data exchange [36], and allows the bidirectional transmission of load, power flow, and status information between local distribution automation elements and higher-level supervisory systems [24]. Altogether, GOOSE has established itself as a cornerstone of substation automation, delivering high-performance, interoperable, and scalable communication for both local and wide-area use cases.

2.3. Cybersecurity in GOOSE Protocol

Despite its widespread adoption in digital substations for real-time protection and control, the GOOSE protocol presents significant cybersecurity vulnerabilities due to its original design prioritizing performance over security [37]. By default, GOOSE messages lack essential security features such as encryption, authentication, and integrity verification, making them susceptible to a range of cyber threats [4,18,37]. These include spoofing attacks, in which an adversary forges GOOSE packets to impersonate legitimate substation devices [4], and false data injection attacks, where attackers manipulate message contents, such as sequence or state numbers, to trigger unauthorized breaker operations or mislead subscribers [4,20].

Furthermore, GOOSE is also exposed to replay attacks, in which previously captured valid messages are resent to provoke unintended responses, and denial-of-service (DoS) attacks that flood the network with false traffic, degrading the availability of critical communication [4]. Its reliance on Layer 2 multicast transmission further enhances these risks [18]. Without robust authentication, receivers cannot discern between legitimate and malicious publishers, especially when MAC-address-based filtering is used as the primary defensive measure [4,37,38]. As a result, Man-In-The-Middle (MITM) and eavesdropping attacks become feasible, violating the confidentiality and integrity principles of the Confidentiality, Integrity, and Availability (CIA) triad [4,18,37].

To address these concerns, IEC 62351 proposes a set of cybersecurity enhancements for IEC 61850-based protocols. These include the use of digital signatures, e.g., Rivest-Shamir-Adleman (RSA) and message authentication codes, such as Hash-based Message Authentication Code (HMAC) and Galois Message Authentication Code (GMAC), to verify authenticity and integrity [37]. However, RT constraints pose substantial implementation challenges, as cryptographic algorithms can introduce processing delays that conflict with GOOSE’s latency requirement of less than 3 ms [37,39]. While symmetric algorithms such as Advanced Encryption Standard (AES) and ChaCha20 have shown promising results in certain configurations [18,37], the trade-off between security and performance remains a critical concern, particularly for IEDs with limited computational resources [18].

Alternative approaches under investigation include geometric-cryptographic methods [37], which have demonstrated compatibility with GOOSE message structures while maintaining low-latency performance [37]. In addition, the deployment of Intrusion Detection Systems (IDS) has emerged as a crucial layer of defense [4]. These systems, often rule-based or anomaly-based using machine learning (ML), monitor for irregularities in GOOSE traffic, such as unusual state transitions or MAC address inconsistencies [18,39,40].

From a network configuration standpoint, best practices involve the segmentation of traffic through VLANs and the deactivation of unused physical ports [18]. Moreover, testing environments employing Hardware-in-the-Loop (HIL) and cybersecurity-focused simulation tools (e.g., RTDS, OMICRON, Wireshark) have been leveraged to validate proposed countermeasures and identify vulnerabilities in real or emulated scenarios [4,5,16,22,31].

Ultimately, while GOOSE remains a cornerstone of digital substation communication [39], its inherent cybersecurity limitations necessitate the careful integration of tailored protective mechanisms [18,37]. Balancing real-time performance with robust security continues to be a central challenge in ensuring the protocol’s safe deployment in increasingly interconnected and threat-prone Smart Grid environments [18].

3. Related Research

Although the breakthrough in research on IEC 61850 is remarkable, reviews that examine GOOSE from a consolidated perspective are rare, usually limited to axes such as security, reliability, or temporal performance, which provide partial views that do not capture the full complexity of the protocol. Ref. [41] conducts a security analysis whose main objective is to evaluate the compliance of the cryptographic mechanisms proposed for GOOSE. Their evidence shows that RSA imposes delays that are incompatible with protective communications and that weaknesses in synchronization compromise the temporal integrity of messages. The results are consistent, but focused solely on safety and performance. Ref. [42] frames a broad view of IEC 61850, describing GOOSE in a functional way. The analysis is technically accurate, but not sufficiently thorough into specific limitations or the maturity of the protocol. Ref. [43] aims to analyze the performance of GOOSE in distributed automation under different experimental conditions. Their results quantify delays, reliability, and topological impacts, but the scope is confined to a specific test scenario. Ref. [44] aims to validate the logical coordination of GOOSE-based protection in a microgrid using HIL. The findings confirm adequate performance times, but the analysis is strongly dependent on the adopted operational context adopted. Ref. [18] seeks to consolidate knowledge about safety in GOOSE through a systematic review. Its results rigorously classify vulnerabilities and countermeasures, but deal only with the cyber dimension, without integrating aspects of performance, interoperability, or technical evolution. Ref. [45] aims to fill a gap in the literature by critically analyzing available testing tools for systems based on the IEC 61850 standard, comparing them in terms of technical capabilities, cost, usability, and customer experience to support informed acquisition decisions. The results indicate that tools such as Infotech and the open-source libraries libIEC61850 and Go-SV provide reliable and cost-effective solutions.

Distinctively from these contributions, which treat GOOSE in a technical and fragmented way, such as from the perspective of safety, a functional component of IEC 61850 and in restrictive experimental studies, as well as context-dependent reviews, this work organizes the protocol in a historical perspective, examining its research evolution since the publication of IEC 61850-8-1. Moreover, by applying the PRISMA framework combined with SciMAT-based bibliometric and thematic mapping, it synthesizes recurring challenges and analyzes how recent research (2020–2025) has addressed these limitations. This historical and systematic overview is crucial because it clarifies what has already been investigated, highlights current research gaps, and thereby supports more informed and effective directions for future developments of the protocol. Therefore, rather than evaluating individual technical solutions, this review differentiates itself from previous works by applying a systematic selection protocol and a combined bibliometric–thematic analysis to reveal the structural evolution of GOOSE research over time.

4. Systematic Literature Review

According to [9], “A Systematic Literature Review (SLR) is a research methodology to collect, identify, and critically analyze the available research studies […] through a systematic procedure”. In this paper, this methodology is used to better understand the evolution of the IEC 61850’s GOOSE protocol during its 22 years of application, as well as its current research trends, according to the following research questions (RQ):

• RQ1: How has GOOSE evolved during its lifetime (2004–2025)?
• RQ2: Which are the known challenges and limitations?
• RQ3: What is the current focus of research regarding the known challenges and limitations?

This research will be divided into two parts: the first will examine articles from journals published in the period of 2004 to 2025 in order to answer RQ1 and RQ2. The second part will examine conference papers published in the period of 2020 to 2025 with the aim of answering RQ3. Considering the extensive time frame of 22 years and the consequently large volume of publications to be analyzed in order to answer RQ1 and RQ2, we chose to restrict the first analysis to articles published in peer-reviewed journals. This choice aims to ensure the maturity, methodological quality, and consolidation of results, criteria that are generally more demanding in journals than in conferences. In addition, this approach allows us to maintain the feasibility and depth of the analysis, avoiding data overload that would compromise the applicability of the criteria for assessing quality and relevance. On the other hand, as RQ3 demands the analysis of more recent developments in the area, in order to discover current research trends, only conference papers were chosen to be analyzed in the second part of the research, because conference proceedings often serve as a platform for the early dissemination of innovative ideas. By treating these two sources separately, the study ensures both depth and topical relevance, while avoiding analytical overload and maintaining methodological clarity.

The predefined outcome domains include temporal evolution, thematic structure, reported challenges and limitations, and emerging research directions. All information relevant to these domains was extracted from the full texts of the selected studies in quantitative and qualitative analysis. In addition, bibliographic and methodological variables such as publication year, publication type, and methodological approach were collected for analysis.

The Scopus database was chosen as the primary source in this research, because it covers 330 subjects in more than 7000 publishers, thus reaching an amount of more than 100 million records [46], making it “currently the largest existing multidisciplinary database” [9]. In addition, the IEEE Xplore and Web of Science databases were used as secondary sources to ensure that no relevant articles were missed in the analysis. Regarding the search for conference papers, only the Scopus database was used, due to its broad multidisciplinary coverage and the high overlap of indexed conference proceedings with other major databases. Including conference papers from all databases would significantly increase the number of duplicates and expand the dataset beyond the scope of the qualitative analysis. Therefore, to maintain a manageable and consistent corpus while still ensuring broad coverage, the conference papers identified in Scopus were used as the representative set for analysis. In addition, the number of conference papers retrieved from Scopus was comparable to those found in other databases (Scopus: 101; Web of Science: 54; IEEE Xplore: 145), indicating that it provides a representative sample of the available literature. Search filters were established in order to find the papers that would fit the best in our research, these being written in English and in the area of Engineering. A general research string was used to search for both articles and conference papers in order to reach the highest number of records of each type according to the filters. In this way, two specific research strings were established, shown in Table 1 below.

Table 1. Research strings used in this SLR.

Articles	Conference Papers
TITLE-ABS-KEY ((“IEC 61850” AND (GOOSE OR “Generic Object Oriented Substation Event”)) AND (“substation automation” OR “smart grid” OR “digital substation”)) AND PUBYEAR > 2003 AND PUBYEAR < 2026 AND (LIMIT-TO (SUBJAREA, “ENGI”)) AND (LIMIT-TO (DOCTYPE, “ar”)) AND (LIMIT-TO (LANGUAGE, “English”))	TITLE-ABS-KEY ((“IEC 61850” AND (GOOSE OR “Generic Object Oriented Substation Event”)) AND (“substation automation” OR “smart grid” OR “digital substation”)) AND PUBYEAR > 2019 AND PUBYEAR < 2026 AND (LIMIT-TO (SUBJAREA, “ENGI”)) AND (LIMIT-TO (LANGUAGE, “English”)) AND (LIMIT-TO (DOCTYPE, “cp”))

By using the research strings in the Scopus database, it was already possible to have some insights into the research about the GOOSE protocol during the selected periods, as Figure 4 shows. It is possible to observe in the figure that the first research article on the topic was published only in 2010, six years after the IEC 61850-8-1, which maps the GOOSE protocol to Ethernet, was published, and after a peak of 12 publications in 2020, this number was cut in half in 2024 and reached 8 publications in 2025. This is particularly interesting because in 2020, both IEC 61850-7-2 and IEC 61850-8-1 Editions 2.1 were published.

Figure 4. Documents published per year on the GOOSE protocol in the Scopus database: (a) articles published in the period from 2004 to 2025 and (b) conference papers published in the period from 2020 to 2025.

The PRISMA protocol, first introduced by [10] and most recently updated by [47], was chosen to assist in the selection of articles for this SLR according to a flow diagram composed of four items: identification, screening, eligibility, and inclusion [10,11,47,48]. This protocol was chosen in order to ensure a transparent and reliable methodology for this SLR, securing a non-biased and discerning analysis of the evolution and latest trends on the GOOSE research and applications. One researcher conducted the protocol by applying the predefined inclusion and exclusion criteria. Eligibility decisions were based on title, abstract, and full-text analysis according to the predefined criteria. Any uncertainties regarding inclusion were discussed jointly among the researchers until consensus was reached. Risk-of-bias considerations were discussed jointly by the reviewers and focused on structural sources of bias related to database selection and selection thresholds. As this review is based on bibliometric and thematic synthesis rather than quantitative effect aggregation, statistical heterogeneity analyses, sensitivity analyses, and formal certainty-of-evidence assessments were not applicable. Potential reporting and publication biases were considered as structural limitations of the review process. In this way, as the analysis of the articles in order to answer RQ1 and RQ2 was carried out first, Figure 5 shows the PRISMA flowchart of this part of the research.

Figure 5. PRISMA flow diagram for article analysis, adapted from [47,49].

The analysis began in the Identification phase. Here, 79 research articles published in journals were found with the research string concerning the GOOSE protocol on smart grids in the Scopus database, 71 were found in the Web of Science database, and 54 were found in the IEEE Xplore database. Among them, 102 duplicates were found, and one study could not be downloaded due to access restrictions. Additionally, papers that were not classified as research articles by the database but still appeared in the search results were discarded, these being two Review Articles, one Topical Review, one Proceeding Paper, and one Conference Paper. Furthermore, articles citing the GOOSE keyword fewer than ten times in the full text were excluded. This threshold was empirically defined after a preliminary screening phase revealed that studies with fewer than ten mentions typically addressed GOOSE only peripherally, for example within broader IEC 61850 discussions, rather than as a central object of investigation. The criterion was therefore adopted as an operational and replicable mechanism to ensure thematic centrality within the final dataset. In this way, 83 articles followed to the Screening stage of the PRISMA protocol.

In the Screening stage, the title, abstract, and keywords of the articles are analyzed in order to find the string’s keywords on them. Two authors carried out the screening process independently. After completing the analysis, the results of both authors were compared. There were no conflicts in the results, and therefore no article was excluded in this phase; the 83 articles were then evaluated for Eligibility. The Eligibility phase consists in completely reading the articles in order to figure if they match the aim of our research before they are submitted to the qualitative and quantitative analysis. In this stage, only one article was discarded because it did not address GOOSE directly, citing it only for contextual purposes. Hence, after processing the papers with the PRISMA Protocol, 82 studies were included in the qualitative and quantitative analysis.

After the PRISMA protocol is completed, the qualitative and quantitative analysis can be carried out. The quantitative analysis was performed with the SciMAT software [49]. SciMAT was developed to conduct science mapping analyses within a longitudinal framework and incorporates a variety of bibliometric measures to quantify the impact and quality of the studied elements, as well as singular features such as a preprocessing stage to filter the raw data before the assessment and an intuitive wizard to configure the analysis [49]. The articles found in the databases were inserted in the software via a Research Information System (RIS) file, and the ones that were discarded during the PRISMA protocol assessment were removed from the database, so that only the 82 articles selected on the PRISMA protocol were analyzed. Then, the data preprocessing was performed, consisting of the creation of word groups by synonyms and themes, resulting in 891 words divided into 28 word groups for analysis.

Additionally, period groups were created. The 22-year period of the research was divided into four periods: 2004–2009 (0 articles), 2010–2014 (7 articles), 2015–2019 (27 articles) and 2020–2025 (48 articles). Although no papers were found for the period from 2004 to 2009, the period was retained in the analysis for illustrative reasons. With the preprocessing done, the analysis could start. In the analysis configuration wizard, the unit of analysis chosen was the keywords of the articles, so the evolution of the themes around GOOSE in the articles on the predefined periods could be evaluated. Then, different metrics were chosen according to the aim of the analysis: kind of network by co-occurrence, normalization measure by association strength, cluster algorithm by sum-linkage, document mapping using core, secondary and intersection documents, quality measuring by h-index, hg-index and sum citations, evolution measure by equivalence index, and overlapping measure by equivalence index.

The same process was performed with the Conference Papers. Figure 6 shows the results PRISMA flow diagram for conference papers.

Figure 6. PRISMA flow diagram for conference paper analysis, adapted from [47,49].

The PRISMA protocol resulted in 84 conference papers for the qualitative and quantitative analysis. In the database search, 101 documents were found, in which 17 were discarded because they cited the GOOSE protocol less than 10 times or had restricted access. After the Identification phase, no articles were discarded; hence, 84 articles were selected for the qualitative and quantitative analysis. The latter was carried out with SciMAT. This time, 815 words were divided into 33 word groups, these including synonyms and conceptually close terms.

With the word groups established, the periods for the analysis were fixed. The 5-year period regarding the conference papers was also divided into three periods: 2020–2021 (25 documents), 2022–2023 (30 documents), and 2024–2025 (29 documents). The analysis of the conference papers could then be performed, and this was done with the same parameters as the journal articles. The results of the quantitative as well as the qualitative analyses for the journal articles and conference papers will be presented and discussed in the next sections.

5. Results and Discussion

As this review is based on bibliometric and thematic synthesis rather than statistical meta-analysis, no quantitative effect aggregation, risk-of-bias assessment at the individual study level, or certainty-of-evidence evaluation was conducted. The results therefore focus on descriptive study characteristics, bibliometric indicators, and thematic evolution patterns generated through SciMAT. Statistical heterogeneity, sensitivity analyses, and effect size estimations were not applicable to the study design.

The quantitative analysis of the research articles with the SciMAT software generated interesting insights about the evolution of the scientific research on the GOOSE protocol during its lifetime. Figure 7 shows the overlapping map of the analyzed periods. For illustrative purposes, the period from 2004 to 2009 was inserted into the image.

Figure 7. Overlapping map of journal articles—keyword groups relations for each period.

It can be seen in Figure 7 that the period from 2010 to 2014 had 19 keyword groups associated with its 7 articles. These keyword groups continued being used in the next period, 2015 to 2019, with the addition of 9 word groups, totaling 28 word groups used as keywords in the 27 articles of the third period. In this way, these keyword groups were 68% similar, as shown by the Similarity Index in the figure. The fact that in the period transitions no keyword group was discontinued indicates that no transitional themes were addressed during the period from 2004 to 2019 in the lifetime of the GOOSE protocol. Thus, it can be interpreted that the research subjects were expanded due to the addition of keywords. Finally, the period from 2020 to 2025, with 48 articles, inherited 96% of the keyword groups from the 2015–2019 period, totaling 27 keyword groups in the last period of the analysis. This indicates a minimal expansion in the latest period [50].

The evolution of the themes of the articles is shown in Figure 8. According to [50], the solid lines indicate that the themes of each period might either be labeled with the same keywords or that one theme is part of the other. The volume of the spheres refers to the number of terms associated with each theme, which in this case is proportional to the number of documents contained by each period.

Figure 8. Evolution map of journal articles according to the core documents of each period.

Thus, “SMART GRIDS” was the main theme of the latest period, which also addressed the “NETWORKS” theme from the second period, which in turn contains the “GOOSE” theme from the first articles found on this area in the 2010–2014 period. This is proven by the strategic diagrams and cluster networks shown in Figure 9. The keywords shown on the evolution map are present on each other’s cluster networks, meaning that they were always related during the evolution of the research on the GOOSE protocol. The strategic diagrams show that in each period, only one word group had the most attention from the research community, with high density and centrality, this meaning that these themes were present with a central role in every article from each period, as shown by the numbers on the circles in Figure 9: (i) “GOOSE”: 7; (ii) “NETWORKS”: 27; and (iii) “SMART GRIDS”: 49.

Figure 9. Strategic diagrams and cluster networks of the core documents from the journal articles in the analyzed periods.

According to [51], themes in the upper-right quadrant in the strategic diagram are known as motor-themes, which are “related externally to concepts applicable to other themes that are conceptually closely related” [51]. This can be seen in the associated cluster networks of each period in Figure 9. In the cluster diagram, the volume of the circles is proportionally related to the number of documents containing each keyword, and the thickness of the lines is proportional to the equivalence index between the two connected keywords [51]. That is, a thick line means that the themes are strongly related, occurring together in documents, and a thin line means that the documents do not appear frequently together. Another characteristic of the cluster network map is that, during the analysis configuration, the construction of these clusters was realized with core, secondary, and intersection mappers. This configuration makes it possible to simultaneously represent the conceptual core of each theme (documents with a high co-occurrence of keywords), the peripheral contributions (documents with only one term associated with the cluster), and the thematic intersections (documents that share keywords between two or more clusters) [50,52].

Consequently, with this information, it is possible to answer the first research question RQ1: “How has GOOSE evolved during its lifetime (2004–2025)?”. The analyses conducted in SciMAT have indicated that research in the field of GOOSE required a period of maturation and consolidation. This assertion is supported by the observation that no articles pertaining to this subject were published in journals during the initial period from 2004 to 2010. It is evident that the beginning of the research can be identified from 2010 onwards, with the publication of four articles between 2010 and 2014, with interrelated topics focused mainly on “GOOSE”, closely relating it to “STANDARDS” of “ELECTRIC SUBSTATIONS” and their connection with “IEC 61850”. Additionally, the subject “TESTBEDS & SIMULATION” is specific to the period from 2010 to 2014 and is not a focus in subsequent periods. This is of particular significance given that these are the first articles related to GOOSE published since the publication of IEC 61850-8-1. It is therefore logical that the first articles focus on “GOOSE”, since they were the first to address this new technology for electrical substations.

The period from 2015 to 2019 was characterized by a predominant focus on “NETWORKS”, with a strong emphasis on its implementation in “ELECTRIC-SUBSTATIONS” and “REAL-TIME-SYSTEMS”. This repeated appearance suggests that these structural themes function as a contextual framework for the primary themes explored in the articles. During this period, the topic of “AUTOMATION” emerges as a significant supporting factor, possibly reflecting the broader trend toward industrial digitalization and the modernization of “POWER SYSTEMS”. This assertion is underpinned by the emergence of the topics “DIGITAL SUBSTATIONS” and “SMART GRIDS”, which underscore the necessity for communication networks to facilitate interaction between decentralized power generation, characterized by smart grids, and the digitization of substations based on IEC 61850 for integration within this novel energy generation system. This necessity arises in response to the escalating global energy demand. The emergence of topics during this period includes also “INFRASTRUCTURE” and “PROTECTION”, both strongly linked to “IEC 61850” and the broader context addressed during this period. Notably, the latter two topics, “POWER SYSTEMS”, and “GOOSE” are not recurrent in the subsequent period. The absence of certain terms from the previous period in the subsequent one does not mean that these research areas were abandoned, but rather that they were absorbed into broader research areas. This behavior can be observed in the overlapping map, which shows that no keywords were discarded in the transition from the 2010–2014 period to the 2015–2019 one. This suggests that the apparent plateau of some themes may reflect a process of thematic integration rather than a decline in their relevance.

In the final period analyzed, “SMART GRIDS” emerged as the predominant theme in the articles. A total of 48 papers were published in academic journals between 2020 and 2025. These papers demonstrated a research focus on the enhanced utilization of GOOSE in the domains of “ELECTRIC SUBSTATIONS” and “NETWORKS”. These subjects had previously been identified as structural topics due to their prevalence in earlier research periods. The “NETWORKS” theme persisted during this period, accompanied by the emergence of new themes such as “CYBERSECURITY” and “CYBER-PHYSICAL-SYSTEMS”. The increased focus on “MODELLING & ALGORITHMS” in the last period is indicative of the interconnected nature of these themes. This underscores the in-depth research into the utilization of the GOOSE protocol in shared networks, involving cyber-physical-systems, digitalization and the mounting concern surrounding the cybersecurity of such systems. An interesting aspect of this period is that the apparent new themes are, in fact, research areas from previous periods that have gained increased attention. This is supported by the absence of newly introduced keywords in this period, as illustrated in the overlapping map. As in the previous period, the absence of certain keywords does not necessarily indicate the abandonment of research areas by the research community. However, the overlapping map shows that one keyword disappeared in the transition from 2015–2019 to 2020–2025. This suggests that the thematic evolution in this period is characterized more by shifts in research emphasis than by the emergence of entirely new research directions.

Consequently, the evolution of research on the GOOSE protocol during its lifetime was characterized by initial studies on the applicability of IEC 61850 in systems that have already applied other protocols, followed by the acceptance of this standard and the creation of integrated and decentralized systems that form smart grids and digital substations. This is of particular interest as in 2013 the first version of IEC 61850-90-7, entitled “Communication networks and systems for power utility automation—Part 90-7: Object models for power converters in Distributed Energy Resources (DER) systems” [53], was published, thus enabling the commencement of related developments. Currently, research on this protocol is undergoing further development with a view to enhancing the security of these interconnected network systems, which have a profound impact on the lives of millions of people and are of critical importance to society. This is being achieved by the emergence of new techniques for testing systems and their security, in addition to integration of IEC 61850 with multiple protocols.

In order to answer RQ2 “Which are the known challenges and limitations?”, all 82 journal articles were individually analyzed by two researchers. The authors read the articles in their entirety and manually identified challenges and limitations covered by them. Although the Table A1 is provided in Appendix A, the categories of challenges and limitations emerging from this analysis are summarized as follows:

• Cybersecurity Vulnerabilities in Time-Critical GOOSE Communication: encompasses susceptibility to spoofing, replay, False Data Injection Attacks (FDIA), MITM, semantic manipulation, and the inadequacy of existing detection and protection mechanisms.
• Timing and Latency Constraints in Real-Time Protection: refers to strict delivery requirements, queuing delays, congestion effects, and performance bottlenecks that threaten sub-millisecond operation.
• Network Performance, Reliability, and Scalability Limitations: includes issues such as packet loss, burst traffic, bandwidth constraints, redundancy inadequacies, and the difficulty of scaling GOOSE architectures beyond local environments.
• Interoperability, Standardization, and Vendor-Specific Issues: captures inconsistencies in implementations, SCL-mapping discrepancies, and the lack of uniform behavior across manufacturers.
• Legacy Systems and Infrastructure Integration Constraints: relates to the challenges of incorporating older relays, non-modernized SCADA components, and heterogeneous communication infrastructures into IEC 61850-based systems.
• R-GOOSE and Wide-Area Protection Limitations: addresses WAN latency, multicast reliability issues, missing handshaking mechanisms, and unresolved security and timing requirements in remote applications.
• Protection System Logic, Coordination, and Application Complexity: refers to difficulties in FLISR, Volt-VAR (VVO) coordination, distributed protection schemes, and the overall complexity of real-time decision-making logic.
• Testing, Validation, Modeling, and Tooling Limitations: includes insufficient experimental testbeds, unrealistic traffic models, limited timing analyses, and a lack of tools for comprehensive security and performance evaluation.
• Protocol-Level Structural Limitations: reflects inherent design constraints of GOOSE and IEC 61850—such as lack of confidentiality, inadequate key-management mechanisms, multicast exposure, and message-format constraints—that restrict secure, scalable, and resilient operation.

With RQ2 addressed, it is possible to proceed to RQ3: “What is the current focus of research regarding the known challenges and limitations?” Accordingly, both quantitative and qualitative analyses of the conference papers were conducted. Figure 10 shows the overlapping map for the conference articles. In 2020–2021, authors used 32 keywords. When transitioning to the period of 2022–2023, one keyword was no longer used, and a new one emerged. This made the second period 94% similar to the first. A similar trend occurred in the transition from the second period to the third (2024–2025): three terms ceased to be used, and a new term emerged. Thus, the most recent period is 88% similar to the period of 2022–2023. A comparison with the Overlapping Map of the Journal Articles reveals the presence of transitional themes, which is indicative of the fact that conference papers tend to address new hypotheses and themes that are less mature than those found in journal articles.

Figure 10. Overlapping map of conference papers—keyword groups relation of each period.

Figure 11 illustrates the development of topics in GOOSE conference papers from 2020 to 2025. According to the thickness of the lines between each period, it is evident that all topics are linked and present in each other’s articles.

Figure 11. Evolution map of conference papers according to the core documents of each period.

In 2020–2021, conference articles focused on “PROTECTION”. In 2022–2023, “DIGITAL SUBSTATIONS” gained more attention. Currently, in 2024–2025, the focus is on “CYBERSECURITY”. This finding suggests that, compared with the field of journal articles, the topics related to “DIGITAL SUBSTATION” and “CYBERSECURITY” align with the article’s focus, as both topics are relevant between 2020 and 2025. “PROTECTION”, conversely, is a structural and consolidated theme present in articles from all periods. The emphasis on “DIGITAL SUBSTATION” and “CYBERSECURITY” may be attributed to the emergence of novel research trends, potentially associated with the expansion of the ‘SMART GRIDS’ theme in recent journal articles. Figure 12 clearly illustrates the centrality of these themes according to the strategic diagrams of the conference papers analyzed in this SLR.

Figure 12. Strategic diagrams and cluster networks of the core documents from the conference papers in the analyzed periods.

In contrast to journal articles, which represent an evolution of topics more closely linked in the initial period, the thematic cohesion of conference papers has always been less pronounced. The underlying reasons for this phenomenon may be multifaceted, including, but not limited to, the diverse thematic content of conferences worldwide, the increased volume of conference papers during a given period, and the tendency of conference papers to address exploratory topics, emerging themes, and preliminary experiments. The majority of the themes exhibited in the conference papers cluster networks demonstrate a high degree of similarity with those observed in journal articles, including “ELECTRIC-SUBSTATIONS” and “NETWORK”. It is also interesting to note that “GOOSE” has not been the main theme of any conferences in the last five years, despite being constantly cited. This indicates that the theme is already consolidated and that developments are currently focused on its improvement, as evidenced by the growth of “CYBERSECURITY” between the second and third periods. In the period from 2024 to 2025, “CYBERSECURITY” shows a significant increase in the volume of papers, and the theme “SMART GRID” re-emerges. The co-occurrence of these themes in recent times suggests that research related to GOOSE is currently centered on the integration of “CYBERSECURITY” into the expanding concept of “SMART GRID”, accompanied by the mounting concerns regarding “DIGITAL SUBSTATION”.

Table 2 presents the qualitative analysis of the conference papers, conducted by two researchers, relating them to the categories identified in the qualitative analysis of journal articles. From the table, it is possible to observe the focus of the 84 conference papers in addressing the challenges identified over the past 22 years. Among the most addressed categories currently are “Cybersecurity Vulnerabilities in Time-Critical GOOSE Communication”, with 35 papers (42%), “Testing, Validation, Modeling, and Tooling Limitations” and “Timing and Latency Constraints in Real-Time Protection”, both with 18 papers (21%). This aligns with the cluster diagrams of the journal and conference papers. Among the less addressed categories in recent years, are “Interoperability, Standardization, and Vendor-Specific Issues”, with 5 papers (6%), “Legacy Systems and Infrastructure Integration Constraints”, with 5 papers (6%), and “R-GOOSE and Wide-Area Protection Limitations”, with 3 papers (4%).

Table 2. Qualitative analysis of the selected conference papers.

Category	Conference Papers
Cybersecurity Vulnerabilities in Time-Critical GOOSE Communication	[39,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87].
Timing and Latency Constraints in Real-Time Protection	[26,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103].
Network Performance, Reliability, and Scalability Limitations	[7,27,66,67,88,92,94,95,98,101,102,104,105,106,107,108,109,110].
Interoperability, Standardization, and Vendor-Specific Issues	[111,112,113,114,115].
Legacy Systems and Infrastructure Integration Constraints	[111,115,116,117,118].
R-GOOSE and Wide-Area Protection Limitations	[24,26,60].
Protection System Logic, Coordination, and Application Complexity	[89,90,91,93,108,119,120,121].
Testing, Validation, Modeling, and Tooling Limitations	[62,77,96,103,109,114,119,122,123,124,125,126,127,128,129,130,131,132].
Protocol-Level Structural Limitations	[39,61,65,66,68,79,110,125,129].

Some of the conference papers shown in Table 2 may be classified under more than one category because the challenges they address often span multiple aspects of substation automation and protection systems. For example, a study on cybersecurity vulnerabilities in GOOSE communication may also report timing and latency issues, since real-time protection relies on both secure and timely message transmission. Similarly, papers proposing new testing frameworks or validation tools may simultaneously highlight limitations in protocol structure or network performance. Therefore, assigning a single paper to multiple categories reflects the interconnected nature of technical, operational, and cybersecurity challenges in IEC 61850-based systems. To evaluate the reliability of the categorization process, inter-rater agreement was assessed using Cohen’s Kappa coefficient [133]. The resulting value (κ = 0.556) indicates moderate agreement between the reviewers according to the interpretation proposed by [134].

With the identification of these research gaps and their attribution to the conference papers, together with the quantitative analyses conducted in SciMAT, it is possible to state that the current research focus on GOOSE is predominantly directed toward cybersecurity, testing, and substation protection, due to the requirements in the area of smart grids. In contrast, topics such as the integration of legacy systems with the protocol, interoperability, and R-GOOSE have received limited attention over the past five years, making these areas particularly promising avenues for future research.

Although no formal methodological quality assessment was performed, the body of literature analyzed presents structural limitations. A significant proportion of studies are simulation-based or conceptual, with limited large-scale empirical validation. In addition, methodological diversity and absence of standardized evaluation metrics restrict direct comparability across studies.

This review is also subject to methodological limitations. The search strategy for the conference papers was restricted to the Scopus database, which may have excluded relevant studies indexed elsewhere or in grey literature. The selection process followed predefined eligibility criteria; however, restrictions related to language and database coverage may influence the comprehensiveness of the sample. Furthermore, bibliometric results depend on keyword standardization and parameter settings defined in SciMAT, which may affect thematic clustering outcomes. This review was not prospectively registered, and no formal protocol was published.

6. Conclusions

GOOSE is a protocol that conforms to the IEC 61850 standard, enabling RT communication between IEDs in the Bay level of electrical substations. This protocol has been shown to disrupt established P&C communication paradigms by adhering to the standardized data model outlined in IEC 61850, which facilitates the integration of the protocol into IEDs from different vendors. The system’s stringent time requirements and utilization of multicast messages via PubSub communication enable the transmission of fault events within 3 ms, thereby facilitating fast action by IEDs in failure events.

The aim of this study was to undertake a historical analysis of articles published on GOOSE since the publication of IEC 61850-8-1, which specified the protocol, in 2004. A number of reviews have previously been published on this subject; however, these have focused on developments related to the technology itself rather than on understanding its evolution to enable guidance and identification of subsequent steps or research paths. Thus, the present study performed an SLR, employing the PRISMA protocol for the methodological selection of articles and the SciMAT software for the quantitative analysis of keywords and the evolution of the topic according to the analyzed period, identifying not only recurring challenges but also thematic transitions across distinct research phases. Unlike previous surveys that primarily focused on specific technical aspects such as cybersecurity mechanisms, implementation frameworks, or performance optimization, this study provides a holistic temporal analysis of how research priorities have evolved within the smart substation domain. Consequently, it was possible to identify the evolution of the themes of the articles related to GOOSE, as well as the challenges and limitations encountered during the research in the last 20 years, these being as follows: “Cybersecurity Vulnerabilities in Time-Critical GOOSE Communication”; “Timing and Latency Constraints in Real-Time Protection”; “Network Performance, Reliability, and Scalability Limitations”; “Interoperability, Standardization, and Vendor-Specific Issues”; “Legacy Systems and Infrastructure Integration Constraints”; “R-GOOSE and Wide-Area Protection Limitations”; “Protection System Logic, Coordination, and Application Complexity”; “Testing, Validation, Modeling, and Tooling Limitations”; and “Protocol-Level Structural Limitations”. The analysis of conference papers facilitated the creation of a state-of-the-art overview of GOOSE research and the identification of ongoing research activities concerning the challenges encountered in the initial analysis, as well as the identification of challenges that require further attention, such as “Interoperability, Standardization, and Vendor-Specific Issues”, “Legacy Systems and Infrastructure Integration Constraints”, and “R-GOOSE and Wide-Area Protection Limitations”.

The present study aims to assist the academic and industry community in identifying research gaps related to GOOSE that still need to be explored, as well as gathering information about the protocol in an extensive background that can help new researchers and engineers better understand its functioning and structure. To the best of the authors’ knowledge, no previous study has systematically examined the thematic evolution of GOOSE research across its full standardization and deployment lifecycle from 2004 to 2025.